What is tool use in AI?

On its own, a language model can only write text. It cannot look up today's weather, open your spreadsheet or send an email. Tool use is how it gets past that. The model is given a list of tools, and when one would help, it asks for it.

How a tool call works

Each tool is described to the model like a card: a name, a sentence on what it does, and the inputs it takes. A weather tool might be "get_weather: the current weather for a city. Input: city name."

You ask "Do I need an umbrella in Leeds?". The model sees the card and, instead of guessing, replies with a short structured request: get_weather, city Leeds. Then it stops.

Here is the step people miss. The model does not run the tool. The program around it, the app, your code or the provider's servers, reads that request, calls the real weather service and pastes the result back into the conversation. The model reads the result and writes its answer: "Yes, rain from 3 pm."

Tools you already use

When ChatGPT or Claude searches the web, that is a tool. So is reading an uploaded file, running code to make a chart, or a connector to your calendar. Many of these now plug in through MCP, an open standard Anthropic launched in 2024 so that one tool can serve many AI apps.

An AgentAgentA model that uses tools in a loop, deciding each next step from what the last one returned, until the task is done. is tool use in a loop: ask for a tool, read the result, decide the next step, repeat.

Why it matters

Tools fix 2 of a model's biggest weaknesses. Search gets it past its knowledge cutoffKnowledge CutoffThe date a model's training text ends. The model knows nothing after it unless it is given new text, for example by a web search.. A calculator or code runner gets it past guessing at arithmetic.

They also add risk, because now the model's words turn into actions. A web page or email it reads through a tool can contain hidden instructions, which is prompt injectionPrompt InjectionAn attack that hides instructions in text a model reads, such as a web page, an email or a file, so the model follows the attacker instead of you.. So a careful setup gives a model only the tools the job needs, and asks you before any tool that sends, pays or deletes.

When an app asks for permission to connect to your mail or drive, it is asking to give its model a new tool. Grant what the task needs and no more.